mcp-server-semgrep/semgrep-rules/python/lang/security/audit/dangerous-subprocess-use-tainted-env-args.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: dangerous-subprocess-use-tainted-env-args
  mode: taint
  options:
    symbolic_propagation: true
  pattern-sanitizers:
    - pattern: shlex.quote(...)
  pattern-sources:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-either:
          - pattern: os.environ
          - pattern: os.environ.get('$FOO', ...)
          - pattern: os.environb
          - pattern: os.environb.get('$FOO', ...)
          - pattern: os.getenv('$ANYTHING', ...)
          - pattern: os.getenvb('$ANYTHING', ...)
      - patterns:
        - pattern-either:
          - patterns:
            - pattern-either:
              - pattern: sys.argv
              - pattern: sys.orig_argv
          - patterns:
            - pattern-inside: |
                $PARSER = argparse.ArgumentParser(...)
                ...
            - pattern-inside: |
                $ARGS = $PARSER.parse_args()
            - pattern: <... $ARGS ...>
          - patterns:
            - pattern-inside: |
                $PARSER = optparse.OptionParser(...)
                ...
            - pattern-inside: |
                $ARGS = $PARSER.parse_args()
            - pattern: <... $ARGS ...>
          - patterns:
            - pattern-either:
              - pattern-inside: |
                  $OPTS, $ARGS = getopt.getopt(...)
                  ...
              - pattern-inside: |
                  $OPTS, $ARGS = getopt.gnu_getopt(...)
                  ...
            - pattern-either:
              - patterns:
                - pattern-inside: |
                    for $O, $A in $OPTS:
                      ...
                - pattern: $A
              - pattern: $ARGS
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-not: subprocess.$FUNC("...", ...)
        - pattern-not: subprocess.$FUNC(["...",...], ...)
        - pattern-not: subprocess.$FUNC(("...",...), ...)
        - pattern-not: subprocess.CalledProcessError(...)
        - pattern-not: subprocess.SubprocessError(...)
        - pattern: subprocess.$FUNC($CMD, ...)
      - patterns:
        - pattern-not: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...)
        - pattern: subprocess.$FUNC("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD)
      - patterns:
        - pattern-not: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...],...)
        - pattern-not: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c","...",...),...)
        - pattern-either:
          - pattern: subprocess.$FUNC(["=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD], ...)
          - pattern: subprocess.$FUNC(("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c", $CMD), ...)
      - patterns:
        - pattern-not: subprocess.$FUNC("=~/(python)/","...",...)
        - pattern: subprocess.$FUNC("=~/(python)/", $CMD)
      - patterns:
        - pattern-not: subprocess.$FUNC(["=~/(python)/","...",...],...)
        - pattern-not: subprocess.$FUNC(("=~/(python)/","...",...),...)
        - pattern-either:
          - pattern: subprocess.$FUNC(["=~/(python)/", $CMD],...)
          - pattern: subprocess.$FUNC(("=~/(python)/", $CMD),...)
    - focus-metavariable: $CMD
  message: >-
    Detected subprocess function '$FUNC' with user controlled data. A malicious actor
    could leverage this to perform command injection.
    You may consider using 'shlex.quote()'.
  metadata:
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    cwe:
    - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
    asvs:
      section: 'V5: Validation, Sanitization and Encoding Verification Requirements'
      control_id: 5.3.8 OS Command Injection
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements
      version: '4'
    references:
    - https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess
    - https://docs.python.org/3/library/subprocess.html
    - https://docs.python.org/3/library/shlex.html
    - https://semgrep.dev/docs/cheat-sheets/python-command-injection/
    category: security
    technology:
    - python
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
  languages: [python]
  severity: ERROR